Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 04:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
249c98356bd4d08b067f5edeb202a025ee595d921b09d56e28eebff8c1ad9676.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
249c98356bd4d08b067f5edeb202a025ee595d921b09d56e28eebff8c1ad9676.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 249c98356bd4d08b067f5edeb202a025ee595d921b09d56e28eebff8c1ad9676.exe
- Size 1.6MB
- Sample260802-ete24adj5v
- SHA256 249c98356bd4d08b067f5edeb202a025ee595d921b09d56e28eebff8c1ad9676
- MD5 60be8bbe06240c54835d2b70d8cd8ae7
- SHA1 6c3fa41d57793c154f75c10512bd35ac2d90a102
- SHA512 f7a64a081fd896f13364e64157e26aeeb7b17660f4291e7592d9d24bb89ccef9d1b6035acb0a665347a17bf403a22c4226123acd5b8de56b68f57f30b5a828ab
- SSDEEP 24576:2vO2xJKRI2FOkx2LFEvcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbAKjH4:2HHKO29Qm5QZuTtS0rQMYOQ+q8CEKT4
- TLSH T1D4759E21B351C036D4AB01758AB987AEA578BD710B2551C7B3C47B7E6FB12D2AA3130F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3724 288deb65 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 3184 249c98356bd4d08b067f5edeb202a025ee595d921b09d56e28eebff8c1ad9676.exe Destination IP 4 223.5.5.5 3184 249c98356bd4d08b067f5edeb202a025ee595d921b09d56e28eebff8c1ad9676.exe Destination IP 28 114.114.114.114 3184 249c98356bd4d08b067f5edeb202a025ee595d921b09d56e28eebff8c1ad9676.exe Destination IP 32 223.5.5.5 3184 249c98356bd4d08b067f5edeb202a025ee595d921b09d56e28eebff8c1ad9676.exe - Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\288deb65 249c98356bd4d08b067f5edeb202a025ee595d921b09d56e28eebff8c1ad9676.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 288deb65 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 288deb65 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 288deb65 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 288deb65 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 288deb65 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 288deb65 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 288deb65 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 288deb65 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 288deb65 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 288deb65 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 288deb65 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 288deb65 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 288deb65 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 288deb65 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\3fc198 288deb65 File opened for modification C:\Windows\3682e0 249c98356bd4d08b067f5edeb202a025ee595d921b09d56e28eebff8c1ad9676.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 249c98356bd4d08b067f5edeb202a025ee595d921b09d56e28eebff8c1ad9676.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 288deb65 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 288deb65 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 288deb65 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 288deb65 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 288deb65 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 288deb65 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 288deb65 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 288deb65 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 288deb65 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 288deb65 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 3724 288deb65 3724 288deb65 3724 288deb65 3724 288deb65 3724 288deb65 3724 288deb65 3724 288deb65 3724 288deb65 3724 288deb65 3724 288deb65 3724 288deb65 3724 288deb65 3184 249c98356bd4d08b067f5edeb202a025ee595d921b09d56e28eebff8c1ad9676.exe 3184 249c98356bd4d08b067f5edeb202a025ee595d921b09d56e28eebff8c1ad9676.exe 3184 249c98356bd4d08b067f5edeb202a025ee595d921b09d56e28eebff8c1ad9676.exe 3184 249c98356bd4d08b067f5edeb202a025ee595d921b09d56e28eebff8c1ad9676.exe 3184 249c98356bd4d08b067f5edeb202a025ee595d921b09d56e28eebff8c1ad9676.exe 3184 249c98356bd4d08b067f5edeb202a025ee595d921b09d56e28eebff8c1ad9676.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3184 249c98356bd4d08b067f5edeb202a025ee595d921b09d56e28eebff8c1ad9676.exe Token: SeTcbPrivilege 3184 249c98356bd4d08b067f5edeb202a025ee595d921b09d56e28eebff8c1ad9676.exe Token: SeDebugPrivilege 3724 288deb65 Token: SeTcbPrivilege 3724 288deb65
Processes
-
C:\Users\Admin\AppData\Local\Temp\249c98356bd4d08b067f5edeb202a025ee595d921b09d56e28eebff8c1ad9676.exe"C:\Users\Admin\AppData\Local\Temp\249c98356bd4d08b067f5edeb202a025ee595d921b09d56e28eebff8c1ad9676.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3184
-
C:\Windows\Syswow64\288deb65C:\Windows\Syswow64\288deb651⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3724
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\3fc198
- Size 506B
- SHA256 df6951e1ae6c3cc0a8b2ee151fceabb47214c4fd83ce45ad046eda8aaa4ced00
- MD5 4b712170b5032901f902f63d0dd38399
- SHA1 86a80940a63fbb54c47e973db660821d0f9ff0c9
- SHA512 c67baf4acb3e62207eeb8b28cb4a278c77c0289caa795221c11e39fbaa35103f059cad9fc0936a561e34508be1c18f98ed2db23ac761894f0086361692cc2b08
- TLSH T1A0F00EBE8877A3490ED9ACA16E231CE42C05A23EC127222529D0FE811C83005DC0384D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\288deb65
- Size 1.6MB
- SHA256 7bafd087a7e8a10fdefe39ea0c4a52a7109437e97caf0090be1ec615a7669f7e
- MD5 a44395c00acf8cf1ef2f11ffea262caf
- SHA1 794b07346b9fd60b27dee15053057d0669f7d51d
- SHA512 5f01fad2945f604352b9fce989be27f38763328be9349fb5473e2d86d14cccfa4b7fa75d9bfe532b907c1941f21ab68387f99f0d7c3fef174c8d7997a8298d64
- SSDEEP 24576:dvO2xJKRI2FOkx2LFEvcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbAKjH4:dHHKO29Qm5QZuTtS0rQMYOQ+q8CEKT4
- TLSH T1CD759E21B351C036D4AB01758AB987AEA578BD710B2551C7B3C47B7E6FB12D2AA3130F
- MD5 SHA1 SHA512 SSDEEP TLSH